20 ms·

Homebrew 4.0.0

456 points by robin_reala 4y ago

stjo 4y ago
> Homebrew’s analytics are now sent both to Google Analytics and our new, self-hosted InfluxDB instance hosted in the EU. > If you had previously set HOMEBREW_NO_ANALYTICS because you didn’t like Google Analytics and/or data being sent to the USA: please consider unsetting this and setting HOMEBREW_NO_GOOGLE_ANALYTICS instead, allowing analytics data to be sent to our new InfluxDB host. My package manager was reporting my actions to Google and I didn’t even know about that. Great…
- _aavaa_ 4y ago
  No kidding. First I’m hearing about it.
  - Terretta 4y ago
    Probably not, as the installer tells you in the same blurb it tells you how to add brew to your .profile. What it doesn't tell you unless you read the URL, is all you have (had) to do is "brew analytics off".
- jray 4y ago
  In your .bashrc or similar: export HOMEBREW_NO_ANALYTICS=1
  - predmijat 4y ago
    That’s not the point. I don’t want any software sending analytics unless I specifically allowed it.
    - darkwater 4y ago
      Then you can either: 1) don't use the software 2) analyze the software source code to understand what it does before using it I tend and prefer to assume good-will WRT telemetry in well-known and independent opensource projects.
      - predmijat 4y ago
        Disagree, it should be the norm.
      - vetinari 4y ago
        You forgot 3) Complain at different intensities, up to the shaming, about the unethical dark patterns employed by the software, no matter whether it is open source or not, to make authors of the software aware, that what they do is not welcome by their users.
      - glenngillen 4y ago
        I use Little Snitch to alert on any outbound connections and make a decision. The google stuff immediately got a permanent blackhole for Homebrew. Anything I'm uncertain of I'll give a short-term approval (30mins) to not break anything. After a couple of rounds of execution (and sometimes some trial & error) you can usually work out which requests are essential and which are some notifications/tracking thing.
        daneel_w 4y ago
        So you didn't see the notice brew(1) gives you on first run?
        glenngillen 4y ago
        I can't recall, though this approach isn't specific to homebrew. I block it permanently at a network/process level rather than having to remember to set a ENV var.
    - nicbou 4y ago
      You know, as the law requires in the EU
      - Xylakant 4y ago
        That is a very simplifying view of the legal situation and that's not helpful at all. First, it only applies if you collect PII - depending on what they collect, they might not be subject to the GDPR at all. Second, informed consent is only one of the options that allows collection and storage of PII. There are various other reason that allow collection and storage of PII, among them "Legitimate interest". For example, it is considered legitimate to store webserver logs containing PII (IP Addresses) for purposes of fraud analysis, unauthorized system access etc. Whether a specific collection of data is legitimate under those clauses depends on the specifics of a case (who has access, what's the exact purpose, how long you store, ...) - ask a lawyer if you need an assessment. Depending on what they log and how they log, they may be either in the clear or in a bad place, but it's definitely not as simple as "the law requires no logging".
        jeroenhd 4y ago
        The analytics page describes them tracking information across time with a unique user identifier. They claim that identifier doesn't identify you, but it's attached to an exact Brew install so it does track your personal account on your machine at the very least; I'd classify that as PII. Had they not submitted unique user tokens I think you mag be right. However, that's not how the analytics seem to work. The law does allow logging for a variety of things but in this case I'd say they're in the wrong. They assume that it's okay because they don't track you across websites and that's good to know, but that's not the point.
      - pimterry 4y ago
        I don't think that's true - AFAICT there's no EU law banning analytics. EU law just restricts storing & processing _personal_ data (GDPR) and storing unnecessary data on machines without consent (ePrivacy/'cookie law'). If you want to log fully anonymized data, without persistent tracking ids and without leaking personal data to 3rd parties en route (so no "send it to Google and they promise to anonymize the IP afterwards") then you're all good (but IANAL!). The only reason you see all those cookie notices and GDPR consent requests is because so few companies are willing to accept even the tiniest tradeoff in their metrics to protect their users' privacy.
    - eesmith 4y ago
      FWIW, it gives you a warning and the chance to disable analytics before sending any analytics. https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics > Homebrew gathers anonymous aggregate user behaviour analytics using Google Analytics (until our in-progress migration to our own InfluxDB). You will be notified the first time you run brew update or install Homebrew. Analytics are not enabled until after this notice is shown, to ensure that you can opt out without ever sending analytics data.
    - prepend 4y ago
      I feel the same way. I think it’s not cool when orgs track telemetry with opt out. But it’s not cool like when you’re at a party and you go off and fart in the corner as no one’s there and then a few seconds later someone walks by and smells it. Continuing the analogy, telemetry with no opt out is like farting silently amongst a group of people. And tracking identified user requests while selling data is like slapping each person at the party while farting in their face. And I guess opt in telemetry is like holding in your fart and people notice and might feel some discomfort at your discomfort.
      - notpushkin 4y ago
        What.
    - macintux 4y ago
      Agreed, I was shocked when I installed the Dart programming language and found out it sends analytics by default. A programming language!
      - orangepurple 4y ago
        An implementation of a build system for a programming language
  - vestrigi 4y ago
    Thanks, a quick search on the home brew page brought no guidance on how to configure these settings. I can't remember if this is in the .bashrc or in some other obscure config file, would be great to mention this if you recommend changing settings to your user base.
- Kelteseth 4y ago
  Why don't they just use something like plausible for this? I switch to plausible for all my analytics and it works great. https://plausible.io/ https://plausible.io/
  - pimterry 4y ago
    Whilst Plausible does look great, one of their main goals, as I understand it, is to focus on simple core analytics for websites, not general-purpose do-it-all analytics for everything. If you're not a website, and so your metrics are arbitrary events with metadata instead of page views, this tends to quickly run into awkward mess. Self hosting an InfluxDB to capture core metrics seems like a good solution that avoids privacy concerns without being too complex imo.
    - Kelteseth 4y ago
      It is fine for medium size applications, you do have to register all events (goals) on the website before you can use them [0]. I have written the Qt/QML plugin for plausible [1], I don't think predefining them is too bad. [0] https://plausible.io/docs/goal-conversions https://plausible.io/docs/goal-conversions [1] https://gitlab.com/kelteseth/qml-plausible https://gitlab.com/kelteseth/qml-plausible
      - pimterry 4y ago
        Ah, neat, ok! I'll take another look. For now I've been testing out Posthog (https://posthog.com https://posthog.com). They seem more focused on this use case - they let you do arbitrary queries and build graphs over all event data without having to predefine goals or anything, and they have an open-source & self-hostable version, in addition to a EU-hosted cloud option. Now that GA is so clearly dying (finally) it's an exciting space!
  - dmak 4y ago
    Thanks for sharing. I was looking for other options and this looks like a good candidate. Does you or anyone else have any other suggestions?
- jillesvangurp 4y ago
  They'd be well advised to make this opt-in only for legal reasons. This is not going to go down well in a lot of places and they might get exposed to law suits.
  - pimterry 4y ago
    As in the post: they're intending to drop the GA part entirely within 90 days, and it sounds like the new metrics are entirely anonymous, and so not covered by GDPR etc. IANAL but as far as I can tell that should avoid all legal concerns once GA is gone.
    - capitol_ 4y ago
      It's hard to send stuff over the Internet without exposing some personal information, like your ip number. I guess they might send it over TOR to get around that.
      - prepend 4y ago
        Isn’t it GDPR compliant if you never store the source ip at all? So from a GDPR perspective there’s no user data to track and remove. I’m not sure how organizations get audited to prove that they actually do that and that there’s no other way to reidentify users (eg, I download the prepend package every day and that’s unusual enough to link that it’s me, prepend, the author of that package, etc etc).
      - mnot 4y ago
        This is exactly the use case that Oblivious HTTP is being built for in he IETF.
    - ianai 4y ago
      Why does a package manager need to track their users at all? If you want usage statistics for packages just track how often individual packages are downloaded on the server side. A maintainer has no need to know who's installing what.
- singularity2001 4y ago
  Yeah, thanks, I set export HOMEBREW_NO_ANALYTICS=1 immediately!
- acdha 4y ago
  It prints a notice when you run it: https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
- yrro 4y ago
  Homebrew should support the DO_NOT_TRACK environment variable. https://consoledonottrack.com/ https://consoledonottrack.com/ It doesn't look likely though. I don't think it looks good that comments pointing out that Homebrew's existing behaviour (collecting analytics without obtaining informed consent from users) violates the law have been classified as abuse and hidden! https://github.com/Homebrew/brew/pull/6745 https://github.com/Homebrew/brew/pull/6745
  - steve1977 4y ago
    Or, just not track.
  - voytec 4y ago
    > Homebrew should support the DO_NOT_TRACK environment variable. No, rather something like TRACK_ME opt-in variable.
  - sneak 4y ago
    In retrospect (consoledonottrack operator here) I never should have pushed an opt out standard; it legitimizes opt-out which is indefensible and unethical. Opt-in by advance consent is the only way. Homebrew devs are unethical jerks. Use nixpkgs and don't look back.
    - therealdrag0 4y ago
      What’s unethical about counting errors with no PII?
      - sneak 4y ago
        Errors are the property of the user on the system in which they occurred. Exfiltrating them without consent is unethical and oftentimes illegal, and leaks the user's IP to Google. Homebrew has no claim to them without the consent of the user. It's simple spyware. Unless you report with Tor, it's not without PII. (Homebrew also includes a unique install UUID supercookie which persists, so every analytics data point includes PII in addition to IP address which allows Google to track that user's physical travel history.)
- Patrol8394 4y ago
  I find this very invasive and I am glad I never used homebrew and always used Macport instead.
  - dagmx 4y ago
    Well I have bad news for you there too https://ports.macports.org/statistics/faq/ https://ports.macports.org/statistics/faq/ I really do think that people who are concerned about telemetry should install Little Snitch and also look at each of these programs documentation. Telemetry is called out for most of them, as well as how to disable it. It’s also not inherently bad as it can be a valuable tool to improve their systems, though obviously could be abused too.
    - cgeier 4y ago
      You need to actively install software to report statistics on macports. See further down the linked FAQ.
      - Patrol8394 4y ago
        Exactly! ``` To start submitting statistics, install the mpstats port in your MacPorts installation. sudo port install mpstats ```
- sneak 4y ago
  Time to write a client to spam both of these unauthenticated data collection endpoints with random noise data to render them useless.
- woodruffw 4y ago
  Homebrew doesn't "report" anything to Google, much less anything of yours (implying unique identification). This is an unnecessary editorialization. You can see exactly how Homebrew does analytics here[1], and you can see the sum total of the information collected here[2]. No identifiable information is collected or retained. [1]: https://github.com/Homebrew/brew/blob/master/Library/Homebrew/utils/analytics.rb https://github.com/Homebrew/brew/blob/master/Library/Homebre... [2]: https://formulae.brew.sh/analytics/ https://formulae.brew.sh/analytics/
  - microtonal 4y ago
    From the Homebrew documentation: A Homebrew analytics user ID, e.g. 1BAB65CC-FE7F-4D8C-AB45-B7DB5A6BA9CB. This is generated by uuidgen and stored in the repository-specific Git configuration variable homebrew.analyticsuuid within $(brew --repository)/.git/config. This does not allow us to track individual users, but does enable us to accurately measure user counts versus event counts. The ID is specific to the Homebrew package manager, and does not permit Homebrew maintainers to e.g. track you across websites you visit. IANAL, but an UUID is definitely PID under the GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Also see recital 30: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. The GDPR doesn't only take into account whether an identifier can currently be used to identify a person, but also whether the data can be correlated in the future to do so (e.g. by correlating package installs with visiting project websites, thus deanonymizing the UUID). The only safe way to abide by the GDPR is to avoid storing any non-essential data without consent. I am pretty sure that Homebrew have been violating the GDPR for years by making analytics opt-out. Sadly, anyone who tries to warn them gets banned from their issue tracker.
- sigzero 4y ago
  > My package manager was reporting my actions to Google and I didn’t even know about that. Great… This has been a known things for a long long time. That is on you for not knowing about it. And it isn't doing anything that you are trying to infer in your statement anyway.
- deleted 4y ago
  [deleted]
tambourine_man 4y ago
I use homebrew like a black box. I’m glad it exists, but I have no idea how it works and why it’s so complicated. When something breaks and Google is no help I just nuke it and start from scratch. It’s only happened twice in more than a decade, but I still have the feeling that I was better off compiling stuff manually and cultivating a tidy /usr/local/bin like I did in early 2000s. But it’s probably rose-colored glasses and I’d definitively never take the time these days.
- acdha 4y ago
  I think you’re right about the rose-colored nostalgia: it’s easy to forget how far behind people got on updates. I remember so many support emails where someone had hit a bug which had been patched a year earlier but never thought to install it. A couple of times where people reinvented something which had been added to PHP in the meantime because they didn’t know it was there.
  - tambourine_man 4y ago
    But do I need the latest openSSL for local development? Seems more trouble than it should.
    - acdha 4y ago
      That’s why they keep it private by default, but the answer is often yes. There have been multiple times where a package like Python 3.10 required a newer version (1.1.1) than the OS release included (I suspect that’s also why the AWS Lambda runtime is stuck on 3.9 since it’s based on Amazon Linux 2 and that uses 1 .0). This has settled down a bit but the big HTTPS-everywhere push last decade flushed out a ton of things which had been quietly aging in place, unnoticed until someone started depending on SNI, newer crypto suites, actually disabling deprecated versions of SSL/TLS, etc.
      - tambourine_man 4y ago
        Maybe it’s quieted down recently after the HTTPS effort, but I feel like I need to download a whole Unix environment, down to the readline, every now and then when I just wanted to install a trivial thing.
aa-jv 4y ago
I wish we could get the industry to understand that when you build-in analytics and make it hard for people to opt out, you're using their resources. Sure, people don't pay for things like Homebrew (can they even?) - but this is no reason to extract resources from end users without their consent or agency. I have to work very hard to get something like Homebrew installed and in-use in my organization - the IT guys detest it, since they don't have the wherewithal to understand it (or else they'd be higher-paid developers) so when I finally do get it installed and in use (because it is a very productive tool), having it phone home just makes the situation worse. IT guys have asked for my blood on more than one occasion, just because they see something 'uncontrollable' phoning home .. this does a lot more harm than good. That said, homebrew has been absolutely responsible for making MacOS usable for development purposes in this ol' hackers lab, so I'll keep using it - but I sure do wish they'd care a little more about the position they put us in, having to justify the use of it to IT guys .. EDIT: Thinking about it, I'm actually not averse to phoning-home, just the automatic/hidden nature of it. If brew asked me, every 5 or so times that I ran it, if I would like to participate in sending anonymized analytics to the brew devs, and showed me what was being sent (instead of obfuscating it), I'd be a lot more inclined to click "[Yes] - this one time" almost every single time ..
- modernerd 4y ago
  > people don't pay for things like Homebrew (can they even?) They can and should! https://github.com/homebrew/brew#donations https://github.com/homebrew/brew#donations
  - aa-jv 4y ago
    Thanks for the link, I've now donated. :)
- Mystery-Machine 4y ago
  Isn't it illegal, under GDPR, to track users without their consent?
  - Gigachad 4y ago
modernerd 4y ago
> brew update will now be run automatically less often (every 24 hours rather than every 5 minutes) and these auto-updates will be much faster as they no longer need to perform the slow git fetch of the huge homebrew/core and homebrew/cask taps’ Git repositories. Excellent! Thanks to the brew team for this — it was always frustrating to install something and have to wait for a full, slow update first.
- febstar 4y ago
  > no longer need to perform the slow git fetch Nice. Rust Cargo is also trialling out something similar.
- atonse 4y ago
  I was just wondering, have they considered storing all that in an SQLite file? And then you could refresh the file every 6 hours, say, and post it on a CDN?
  - modernerd 4y ago
    Using SQLite instead of JSON could have worked too and would likely make the manifests smaller: > curl -sI https://formulae.brew.sh/api/formula.json https://formulae.brew.sh/api/formula.json | grep content-length => 19898457 (~19.9MB) > curl -sI https://formulae.brew.sh/api/cask.json https://formulae.brew.sh/api/cask.json | grep content-length => 4023930 (~4MB) But the JSON API has been around for a while so brew 4.0 just makes use of it by default. Brew 3.3 added an off-by-default HOMEBREW_INSTALL_FROM_API bool to let you install from brew's JSON-based API instead of checking out the large (and slow) homebrew/core and homebrew/taps repos: https://formulae.brew.sh/docs/api/ https://formulae.brew.sh/docs/api/ Brew 4 just makes that the default and deprecates the env var (you can use HOMEBREW_NO_INSTALL_FROM_API=1 if you still want to check out the git repos for some reason).
    - mikemcquaid 4y ago
      Homebrew actually passes `--compressed` here so it's smaller: > curl -sI --compressed https://formulae.brew.sh/api/formula.json https://formulae.brew.sh/api/formula.json | grep content-length => 3482583 (~3.3MB) > curl -sI --compressed https://formulae.brew.sh/api/cask.json https://formulae.brew.sh/api/cask.json | grep content-length => 722915 (~0.6MB)
throw0101c 4y ago
On macOS, has anyone moved from/to MacPorts to/from Homebrew? Why did you move? What are the pros and cons of each system?
- dchest 4y ago
  Moved a long time ago, mostly because MacPorts installed their whole own world of dependencies, while Homebrew used system libraries where possible.
  - pseudalopex 4y ago
    Homebrew gave up using OS libraries a long time ago.
- dopidopHN 4y ago
  Yah like a decade ago. I started to find what I was looking for under home brew, and not with port or fink
- lrvick 4y ago
  Both are a security shit show, but at least macports bothers to sign their packages.
  - acdha 4y ago
    What security benefit do you think that provides?
- acdha 4y ago
  I switched from MacPorts to Homebrew very early on because it was better contained. I had to support developers who would build with MacPorts and end up with something which would crash with a linker error when they shared it with someone off the team because it was using a MacPorts binary in a non-standard location, or whose shell scripts broke expecting a GNU CLI utility version which was in their path but not their users. MacPorts also took forever to build since it dragged in so many replacements for system libraries. Homebrew has done a much better job of staying out of the way.
st3fan 4y ago
Before this whole threads turns into a misinformed rant fest about opt out telemetry: “Homebrew gathers anonymous aggregate user behaviour analytics using Google Analytics (until our in-progress migration to our own InfluxDB). You will be notified the first time you run brew update or install Homebrew. Analytics are not enabled until after this notice is shown, to ensure that you can opt out without ever sending analytics data.”
- jeroenhd 4y ago
  That's opt-out, though? It's nice that they tell you, but they don't give you a choice. They're just warning you that you need to opt out. That's not the same as opting in. They're also claiming to log anonymous data while the data they collect is actually pseudonymous as its tied to your specific machine/user, which means it has a whole different status in different privacy jurisdictions. It seems like they could make the data collection anonymous relativelt easily if they just stop tracking individual user installs, though.
  - acdha 4y ago
    They don’t collect data until after you’ve been given the chance to opt out. > It seems like they could make the data collection anonymous relatively easily if they just stop tracking individual user installs, though. Doing that would skew the reports to more active users & automated scripts. If you’re asking questions like “how many people will notice if we deprecate this?” you don’t want to count the guy who hammers “brew update” every other command many times more than someone who updates weekly.
    - jeroenhd 4y ago
      > They don’t collect data until after you’ve been given the chance to opt out. That does still make it opt-out, though, even if it's a friendly opt-out. Microsoft's dotnet tools do the same thing. > Doing that would skew the reports to more active users & automated scripts. If you’re asking questions like “how many people will notice if we deprecate this?” you don’t want to count the guy who hammers “brew update” every other command many times more than someone who updates weekly. I know why they're collecting personal identifiers and I completely understand their reasoning behind it. Every website and service does this in some fashion because most requests are automated. You should still ask before you submit any telemetry, though.
Mystery-Machine 4y ago
I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't even offer alternative. They just say "we can't test all of the packages installed and all version combinations, so this is the best we can do". Well, no one asked you to test my exact setup. All I'm asking for is: if I have perfectly working Node 18 and I need to install fcking Shopify CLI, don't fcking install Node 19 and break my whole setup! Tf?!
- deleted 4y ago
  [deleted]
- BillinghamJ 4y ago
  You could always manage your packages and their dependencies yourself. Or you could release a new package manager which does provide support for that functionality, build out a team of maintainers, and stay on top of all the releases
  - gizmo 4y ago
    That's like saying "if you don't like your country, start your own". The goal isn't to abandon homebrew, but to have it not break things all the time.
    - notpushkin 4y ago
      It's really not. It's borderline impossible (pun intended) to start your own country, mainly because you need to find a piece of land first. Starting a package manager is, like, a few months of work?
  - tacker2000 4y ago
    Thats such a cop out answer! So according to you nobody is allowed to criticise anything because “shut up and build it yourself if you dont like it”?
- hnlmorg 4y ago
unconed 4y ago
I wonder how many more major versions until "brew update" and "brew upgrade" finally just do the same thing. "But they're not the same!" I don't care.
- thiht 4y ago
  That makes no sense. They're NOT the same. > I don't care. It doesn't change facts.
  - unconed 4y ago
    This is a lesson about mental models. From the brew devs' point of view it doesn't make sense because they are different commands. From the end user's point of view it makes perfect sense because brew is just a tool to install shit with and they do not wish to expend any brain cycles on it. That includes remembering whether this particular tool calls it update or upgrade. You know the second point of view is right because if you type one without arguments, it asks you whether you meant to type the other one. But they're too autistic to realize what that means and actually fix the interface. brew update - update brew brew update thing - update thing Done. Similarly, as someone who only rarely uses it, a huge frustration is that when I do, it invariably wants to update 100+ packages. I never asked for it to do that and I was happy with whatever was installed right before it decided to do that and block my system for 20 minutes. Again, brew devs do not understand their audience.
    - yamtaddle 4y ago
      Disagree. I've been a user for a lot of years and prefer the apt-like distinction between the commands. They do different things. > Similarly, as someone who only rarely uses it, a huge frustration is that when I do, it invariably wants to update 100+ packages. I never asked for it to do that and I was happy with whatever was installed right before it decided to do that and block my system for 20 minutes. There's a setting for that, no need for it to keep being a huge frustration.
      - 4y ago
lrvick 4y ago
Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now. When you install brew you are giving hundreds of people (or anyone who has access to their Github accounts) full remote code execution on your machine. Never ever use brew on a machine you use to access production.
- acdha 4y ago
  If they were using signed binaries wouldn’t the same people who have permission to merge code have permission to sign compiled binaries (or, realistically, start a CI process which does)?
- tasuki 4y ago
  I've been using Linux for the past 18 years or so, but damn do the M1 macs look interesting. How does one manage packages on a mac?
  - Squarex 4y ago
    you could use nix
    - nishanths 4y ago
      some more choices: MacPorts, pkgsrc
  - Chiron1991 4y ago
    Excluding 3rd party tools like Homebrew, one dosn't. The native 'package manager' is the Apple App Store. You can also manually download and install .dmg files of applications (much like .deb or .rpm).
    - lockhouse 4y ago
      macOS also has .pkg installer packages that are native. The only issue is that there is no uninstall functionality built in to them unless the package provides their own. https://en.wikipedia.org/wiki/Installer_(macOS) https://en.wikipedia.org/wiki/Installer_(macOS)
anshargal 4y ago
While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. I think this will also hurt the Mac platform. I wish Apple would invest some effort into building an App Store for cli programs. While it may be complicated for the community(require signing, sandboxing, developer effort), it is likely to have better security guarantees than Homebrew.
- rswail 4y ago
  They have, it's called Macports. It started as a port to Darwin of the existing *BSD ports and (I believe) is subsidized by Apple. It installs itself in /opt/local, it respects the Apple SIP. Homebrew basically sucks, because it doesn't follow Unix conventions and it doesn't follow MacOS conventions. Macports has both pre-compiled and build-from-source, supports current and past MacOS releases, uses xcode/clang for compilation, supports port variants and multiple versions installed in parallel (with "port select" to choose a default) etc etc. Not sure why people use anything else.
- nrvn 4y ago
  This, absolutely! Apple should close this gap and I am puzzled why they have not done that yet. Because even for iOS development people need things beyond the xcode toolcahin and they resort to either of the available options. Homebrew is just one of them. Not only cli app store but the mac app store also badly needs some love.
  - SllX 4y ago
    In 2010 I wanted Apple to do this. In 2023 I want Apple to stay as far the hell away as possible from App and package management as possible on my Macintosh. I don’t have the same hang ups on my iPhone, but I don’t want a merger of policies and incentives between the two platforms either.
- ianai 4y ago
  Or just hire a few FTEs to properly support and maintain the CLI. Pull in new FreeBSD base at releases if they really want to axe their overhead. It's always just read as absolutely lazy how slowly the CLI progresses. Hire a few more and they could absolutely offer a package repo. This company dwarfs Red Hat prior acquisition. A company like Apple could kick whatever money to an OSS project and write it off as charity for taxes, I think for that matter.
Lio 4y ago
Thanks for the hard work everyone. I've used brew and brew installed software almost everyday since it was first launched way back when. Mike, Max and the gang have materially improved my life at least, cheers! :D
- latexr 4y ago
  Despite mentioning he started Homebrew every chance he gets, Max hasn’t been part of Homebrew for longer than he was a part of it.
Upvoter33 4y ago
Man there are a lot of complaints about this free software no one is forcing you to use. I would start with a thanks to the people who spend a lot of time on this, and probably not for much wealth. I know I greatly appreciate the existence of homebrew.
- wg0 4y ago
  Entitlement syndrome. Nothing is perfect, not even paid software is perfect. At least open source gives a chance for someone to look into how it's done, suggest/discuss something different and submit a modification if affordable. EDIT: Typo
- elteto 4y ago
  [flagged]
  - dang 4y ago
    Please don't take HN threads further into flamewar. We're trying for something different here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- dagmx 4y ago
  Not even just entitlement, but a lot of people thrown off by the existence of telemetry. Telemetry that it tells you about when you install it, and is mentioned on their site. So not only are people complaining about free software, they’re complaining because they don’t pay attention. It’s the “Everything someone else does is not as good as what I do” mentality
- wayne-li2 4y ago
  This is the ugly side of HN in my opinion. Discussions here are usually very reasonable, except for a few subjects such as telemetry. I guess to the hacker heads of HN, telemetry is as political as religion for regular people.
- deleted 4y ago
  [deleted]
t8sr 4y ago
As an old hand who was around when homebrew started, I feel obliged to let people know there are alternatives. If you find brew's take-over-your-system-and-youll-thank-me approach off putting, and/or you value stability over the coolness factor, MacPorts is still alive and well (https://www.macports.org https://www.macports.org), and in-fact has basically all the same packages brew does. In 18 years of using MacPorts, it's never messed up my system, broken something that used to work or decided that I don't get to run commands right now, because it wants to run an upgrade. (It's also never spied on me.) The price you pay for that is that more things are compiled from scratch, but hey - you only have to do that once, and it only takes like 20 minutes on a modern Mac. Upgrades are generally pretty fast.
- baliex 4y ago
  I used to be a staunch macports evangelist but ended up switching to homebrew. I've found it to be much simpler. And, as a counter to your experience of not having it mess up a machine, every time you upgrade macOS to the next major version you have to jump through some hoops to get it to play ball again. Painful. At some point I gave up on the hoops and installed homebrew instead and haven't looked back.
  - drcongo 4y ago
    This exactly mirrors my experience with the two systems.
  - t8sr 4y ago
    Well, you can nuke macports just by deleting /opt/local. It's annoying to have to recompile for sure, but at least it's a simple solution.
    - baliex 4y ago
      That does sound simple, but is not the process the macports docs suggest.
    - ezfe 4y ago
      You can do the same thing with brew, `/opt/local/brew`
toastercat 4y ago
I used Linuxbrew for a while before switching completely to nix-pkg due to some recurring issues I had downloading some packages. nix-pkg is quite nice and noticeably faster, although rough around the edges, and the commands are hard to remember (so I just set some aliases), but overall I am happy.
- mekster 4y ago
  For Linuxbrew, having packages installed under, /home/linuxbrew/.linuxbrew makes you wonder how much of the developer's mind is "works for me" instead of following more common sense conventions like at least put them under /usr/local or /opt instead of some special user folder in /home.
anacrolix 4y ago
Rewrite it in something compiled already, it's insanely slow
- jray 4y ago
  Crystal is good option. https://crystal-lang.org/ https://crystal-lang.org/
- wg0 4y ago
  <insert rust is the cure for life, death and beyond, compiles safely to 42>
- darthrupert 4y ago
  One would think that most of what it does is IO. Perhaps the resolver could be written in Rust for maximum effect?
- woodruffw 4y ago
  Ruby is slow, but Ruby is not the main reason Homebrew can be slow: Homebrew's execution time is mostly bound by network round-trips and I/O.
wg0 4y ago
Thank you. I tend to rely for even open source GUI apps because the experience of installing/removing packages have been smooth (at least for me) so even on Ubuntu, I find myself using brew instead of apt/snap for personal use. Side question - what can we do about improving security? Of the possibility that packages are not poisoned? Some sort of central CA/GPG or similar requiring to sign the packages or there would always be some holes and it is a hard problem to solve?
- Hackbraten 4y ago
  Prior discussions on package signing: - https://github.com/Homebrew/brew/issues/5852 https://github.com/Homebrew/brew/issues/5852 - https://github.com/Homebrew/brew/pull/4120 https://github.com/Homebrew/brew/pull/4120
ramesh31 4y ago
Is it still slow?
- CharlesW 4y ago
  `brew` has never been slow for me. (Subjective, obv.)
  - yamtaddle 4y ago
    I've heavily used probably four Linux package managers, plus both major ones on Mac, and have used two or three less-common Linux package managers at least a little bit, plus a couple of the BSDs. Oh, and Chocolatey on Windows. I've never gotten this complaint about Brew at all. It has never seemed notably slow to me.
    - fliife 4y ago
      Nothing can feel slow to me anymore after dealing with emerge on gentoo, spending close to 20min solving dependency requirements. Surprisingly, compiling everything was the quick part, the frustration came from dependency resolution
    - silverwind 4y ago
      Try Arch's pacman which installs hundrets of packages in a few seconds. brew is like factor 50 slower than pacman.
    - deleted 4y ago
      [deleted]
- silverwind 4y ago
  It's still ruby so it's still slow.
tacker2000 4y ago
[flagged]
- antihero 4y ago
  You shouldn’t use brew for development tools and runtimes really, you should should use a language specific version manager or asdf. Brew for system stuff.
  - tacker2000 4y ago
    I agree! The problem is, in the PHP world i rely heavily upon Laravel Valet, and it supports only brew…
  - jillesvangurp 4y ago
    Agreed, sdkman and mini conda are two nice options for this. In general, anything Java, python, node.js, etc. related you don't want to have installed globally if you can avoid it.
- nonninz 4y ago
  Agreed. For these kinds of versioned tools (mostly language compilers/interpreters) I've switched to asdf[1][2] and never looked back. $brew install asdf [1] https://asdf-vm.com/ https://asdf-vm.com/ [2] https://news.ycombinator.com/item?id=33323261 https://news.ycombinator.com/item?id=33323261
- DanHulton 4y ago
  Does "nazi" even mean anything anymore, or do we just use it to describe things we don't like? Does nobody care about Godwin's law?
  - rvz 4y ago
    It is so overused that it has lost almost all its meaning. It's getting very boring to see it being used around loosely and carelessly, especially when the word is used to describe things that people don't like. Godwin's Law certainly applies in this case.
mkrishnan 4y ago
well, still needs `sudo` :( :(
- thiht 4y ago
  You can install brew locally: https://stackoverflow.com/a/35867178 https://stackoverflow.com/a/35867178 It's not supported officially (ie. if you have issues with a package you're on your own), but it works great. I've used Homebrew like this for a few years.
- mdaniel 4y ago
  Aside from what the sibling comment said about the "local" install, if you don't want them to run sudo for you, I'd bet $5 that so long as the directories end up with the permissions necessary, you could (effectively) `alias sudo='env'; brew install` and it'd be fine. I do not have `NOPASSWD` on sudo and I can attest that with all my years of Homebrew and Linuxbrew, it has never once tried to run sudo "under the covers"
- n8henrie 4y ago
  As do apt, pacman, a multi-user nix install... isn't that pretty standard for a system-wide package manager?
bsnnkv 4y ago
I have a lot of love for Homebrew from many years of using it, but I don't think you'll ever find me using it in macOS or Linux again. I use Nix on both now and I'm convinced that it is the saner way of doing things.
- dividedbyzero 4y ago
  Does Nix still have that extremely steep and high learning curve and huge time invest before you actually grok it? I'd love a Nix that is about as hard to use as homebrew, but no luck so far.
  - rch 4y ago
    This might be helpful: -- https://zero-to-nix.com/ https://zero-to-nix.com/ Someone also did a video walkthrough of this material recently. I don't have the link, but it might be worth searching for.
  - bojo 4y ago
    To be fair you only really need to know the commands to invoke which are similar to brew as far as what they do, and not the underlying nix expression language which is where things get difficult. Unless you intend to go full power user and add your own overrides, in which case might not be worth it.
  - bsnnkv 4y ago
    Imo, no. I think the documentation is very good, unlike what I had heard. The thing that I really had to invest in was my ability to patiently read documentation closely instead of aimlessly trying to find a shortcut by jumping around the doc pages.
    - anthlax 4y ago
      Haha - I really began to learn nix when I started to read the docs before bed like a novel. I’ve started to do this for more libs / frameworks and it’s going quite well - It seems to be the fast track to power user status!
dividedbyzero 4y ago
One thing about Homebrew that's really great and somewhat obscure is that you can use Ruby code inside brewfiles. I use that to have just one brewfile in yadm and make it do slightly different things on work vs personal laptop.
cratermoon 4y ago
All of these Homebrew users complaining about telemetry in brew, but they use Apple macOS? https://news.ycombinator.com/item?id=25204909 https://news.ycombinator.com/item?id=25204909
ossusermivami 4y ago
I am grateful for brew! I have a macbook that I use sometime and it let me install software easily on it...
gandalfgeek 4y ago
Just came here to say big thanks to the Homebrew crew. First thing I install on a new Mac. There's so much thankless toil that goes into maintaining package infrastructure that we all just take for granted. Thank you!
cunningfatalist 4y ago
Working on a Mac wouldn't be the same without Homebrew. Thanks for all the hard work!
- ripley12 4y ago
  I feel the same way about Linux - big thanks to the Homebrew team.
jiayo 4y ago
Didn't the author sunset this project to become a web3 advocate and pivot to a new project where some dubious NFT would be exchanged for package installations? I guess 2022 came and went since then...
- deleted 4y ago
  [deleted]
- coolspot 4y ago
  https://youtu.be/zcL4oOTZv1o?t=115 https://youtu.be/zcL4oOTZv1o?t=115
- latexr 4y ago
  You’re thinking of Max Howell, the original creator of Homebrew. Rest assured, Max hasn’t been part of Homebrew for years—for longer than he was ever a part of it—so he has no hand in sunsetting or making other decisions on Homebrew’s behalf. Regarding his web3 stuff, the Homebrew developers learned about them at the same time as everyone else (there was a tweet from the official account at the time). There is no relation between both projects. Max takes every chance he gets to mention Homebrew, so the confusion is understandable but unfortunate. Even in his web3 package manager he mentions Homebrew as if it’s the old stuff.
dmillar 4y ago
TIL homebrew updated(s) itself automatically
WirelessGigabit 4y ago
Time to set HOMEBREW_NO_GOOGLE_ANALYTICS HOMEBREW_NO_ANALYTICS I hate opt-outs.
- deleted 4y ago
  [deleted]
nikolay 4y ago
Yikes! This no longer shows the new formulae and casks - I've used Homebrew as a discovery tool, now I need to watch the git commits [0]! [0]: https://github.com/search?q=repo%3AHomebrew%2Fhomebrew-core+%22%28new+formula%29%22&type=commits&s=committer-date&o=desc https://github.com/search?q=repo%3AHomebrew%2Fhomebrew-core+...
- latexr 4y ago
  Subscribe to the commits with an RSS reader: https://github.com/Homebrew/homebrew-core/commits/master.atom https://github.com/Homebrew/homebrew-core/commits/master.ato...
  - nikolay 4y ago
    Both approaches only show the new formulae in the main tap - the old behavior showed across all taps you're subscribed to.
    - latexr 4y ago
      If you really want to keep the old behaviour add `export HOMEBREW_NO_INSTALL_FROM_API=1` to your shell’s startup files. You won’t get the speed boost from the new behaviour but it seems like a tradeoff you’d be willing to make.
      - nikolay 4y ago
        Unlike the old `export HOMEBREW_UPDATE_REPORT_ALL_FORMULAE=1`, which I've had already, your suggestion actually works! Thank you!
- mdaniel 4y ago
  I can't swear to it, because I have a locally patched copy that reports the way I want, but I believe `export HOMEBREW_UPDATE_REPORT_ALL_FORMULAE=1` may put that behavior back: https://docs.brew.sh/Manpage#environment https://docs.brew.sh/Manpage#environment
rainboiboi 4y ago
Thank you for the hard work in maintaining Brew!

456 points by robin_reala 4y ago

stjo 4y ago

> Homebrew’s analytics are now sent both to Google Analytics and our new, self-hosted InfluxDB instance hosted in the EU. > If you had previously set HOMEBREW_NO_ANALYTICS because you didn’t like Google Analytics and/or data being sent to the USA: please consider unsetting this and setting HOMEBREW_NO_GOOGLE_ANALYTICS instead, allowing analytics data to be sent to our new InfluxDB host. My package manager was reporting my actions to Google and I didn’t even know about that. Great…

_aavaa_ 4y ago
No kidding. First I’m hearing about it.
- Terretta 4y ago
  Probably not, as the installer tells you in the same blurb it tells you how to add brew to your .profile. What it doesn't tell you unless you read the URL, is all you have (had) to do is "brew analytics off".
jray 4y ago
In your .bashrc or similar: export HOMEBREW_NO_ANALYTICS=1
- predmijat 4y ago
  That’s not the point. I don’t want any software sending analytics unless I specifically allowed it.
  - darkwater 4y ago
    Then you can either: 1) don't use the software 2) analyze the software source code to understand what it does before using it I tend and prefer to assume good-will WRT telemetry in well-known and independent opensource projects.
    - predmijat 4y ago
      Disagree, it should be the norm.
    - vetinari 4y ago
      You forgot 3) Complain at different intensities, up to the shaming, about the unethical dark patterns employed by the software, no matter whether it is open source or not, to make authors of the software aware, that what they do is not welcome by their users.
    - glenngillen 4y ago
      I use Little Snitch to alert on any outbound connections and make a decision. The google stuff immediately got a permanent blackhole for Homebrew. Anything I'm uncertain of I'll give a short-term approval (30mins) to not break anything. After a couple of rounds of execution (and sometimes some trial & error) you can usually work out which requests are essential and which are some notifications/tracking thing.
      - daneel_w 4y ago
        So you didn't see the notice brew(1) gives you on first run?
        glenngillen 4y ago
        I can't recall, though this approach isn't specific to homebrew. I block it permanently at a network/process level rather than having to remember to set a ENV var.
  - nicbou 4y ago
    You know, as the law requires in the EU
    - Xylakant 4y ago
      That is a very simplifying view of the legal situation and that's not helpful at all. First, it only applies if you collect PII - depending on what they collect, they might not be subject to the GDPR at all. Second, informed consent is only one of the options that allows collection and storage of PII. There are various other reason that allow collection and storage of PII, among them "Legitimate interest". For example, it is considered legitimate to store webserver logs containing PII (IP Addresses) for purposes of fraud analysis, unauthorized system access etc. Whether a specific collection of data is legitimate under those clauses depends on the specifics of a case (who has access, what's the exact purpose, how long you store, ...) - ask a lawyer if you need an assessment. Depending on what they log and how they log, they may be either in the clear or in a bad place, but it's definitely not as simple as "the law requires no logging".
      - jeroenhd 4y ago
        The analytics page describes them tracking information across time with a unique user identifier. They claim that identifier doesn't identify you, but it's attached to an exact Brew install so it does track your personal account on your machine at the very least; I'd classify that as PII. Had they not submitted unique user tokens I think you mag be right. However, that's not how the analytics seem to work. The law does allow logging for a variety of things but in this case I'd say they're in the wrong. They assume that it's okay because they don't track you across websites and that's good to know, but that's not the point.
    - pimterry 4y ago
      I don't think that's true - AFAICT there's no EU law banning analytics. EU law just restricts storing & processing _personal_ data (GDPR) and storing unnecessary data on machines without consent (ePrivacy/'cookie law'). If you want to log fully anonymized data, without persistent tracking ids and without leaking personal data to 3rd parties en route (so no "send it to Google and they promise to anonymize the IP afterwards") then you're all good (but IANAL!). The only reason you see all those cookie notices and GDPR consent requests is because so few companies are willing to accept even the tiniest tradeoff in their metrics to protect their users' privacy.
  - eesmith 4y ago
    FWIW, it gives you a warning and the chance to disable analytics before sending any analytics. https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics > Homebrew gathers anonymous aggregate user behaviour analytics using Google Analytics (until our in-progress migration to our own InfluxDB). You will be notified the first time you run brew update or install Homebrew. Analytics are not enabled until after this notice is shown, to ensure that you can opt out without ever sending analytics data.
  - prepend 4y ago
    I feel the same way. I think it’s not cool when orgs track telemetry with opt out. But it’s not cool like when you’re at a party and you go off and fart in the corner as no one’s there and then a few seconds later someone walks by and smells it. Continuing the analogy, telemetry with no opt out is like farting silently amongst a group of people. And tracking identified user requests while selling data is like slapping each person at the party while farting in their face. And I guess opt in telemetry is like holding in your fart and people notice and might feel some discomfort at your discomfort.
    - notpushkin 4y ago
      What.
  - macintux 4y ago
    Agreed, I was shocked when I installed the Dart programming language and found out it sends analytics by default. A programming language!
    - orangepurple 4y ago
      An implementation of a build system for a programming language
- vestrigi 4y ago
  Thanks, a quick search on the home brew page brought no guidance on how to configure these settings. I can't remember if this is in the .bashrc or in some other obscure config file, would be great to mention this if you recommend changing settings to your user base.
Kelteseth 4y ago
Why don't they just use something like plausible for this? I switch to plausible for all my analytics and it works great. https://plausible.io/ https://plausible.io/
- pimterry 4y ago
  Whilst Plausible does look great, one of their main goals, as I understand it, is to focus on simple core analytics for websites, not general-purpose do-it-all analytics for everything. If you're not a website, and so your metrics are arbitrary events with metadata instead of page views, this tends to quickly run into awkward mess. Self hosting an InfluxDB to capture core metrics seems like a good solution that avoids privacy concerns without being too complex imo.
  - Kelteseth 4y ago
    It is fine for medium size applications, you do have to register all events (goals) on the website before you can use them [0]. I have written the Qt/QML plugin for plausible [1], I don't think predefining them is too bad. [0] https://plausible.io/docs/goal-conversions https://plausible.io/docs/goal-conversions [1] https://gitlab.com/kelteseth/qml-plausible https://gitlab.com/kelteseth/qml-plausible
    - pimterry 4y ago
      Ah, neat, ok! I'll take another look. For now I've been testing out Posthog (https://posthog.com https://posthog.com). They seem more focused on this use case - they let you do arbitrary queries and build graphs over all event data without having to predefine goals or anything, and they have an open-source & self-hostable version, in addition to a EU-hosted cloud option. Now that GA is so clearly dying (finally) it's an exciting space!
- dmak 4y ago
  Thanks for sharing. I was looking for other options and this looks like a good candidate. Does you or anyone else have any other suggestions?
jillesvangurp 4y ago
They'd be well advised to make this opt-in only for legal reasons. This is not going to go down well in a lot of places and they might get exposed to law suits.
- pimterry 4y ago
  As in the post: they're intending to drop the GA part entirely within 90 days, and it sounds like the new metrics are entirely anonymous, and so not covered by GDPR etc. IANAL but as far as I can tell that should avoid all legal concerns once GA is gone.
  - capitol_ 4y ago
    It's hard to send stuff over the Internet without exposing some personal information, like your ip number. I guess they might send it over TOR to get around that.
    - prepend 4y ago
      Isn’t it GDPR compliant if you never store the source ip at all? So from a GDPR perspective there’s no user data to track and remove. I’m not sure how organizations get audited to prove that they actually do that and that there’s no other way to reidentify users (eg, I download the prepend package every day and that’s unusual enough to link that it’s me, prepend, the author of that package, etc etc).
    - mnot 4y ago
      This is exactly the use case that Oblivious HTTP is being built for in he IETF.
  - ianai 4y ago
    Why does a package manager need to track their users at all? If you want usage statistics for packages just track how often individual packages are downloaded on the server side. A maintainer has no need to know who's installing what.
singularity2001 4y ago
Yeah, thanks, I set export HOMEBREW_NO_ANALYTICS=1 immediately!
acdha 4y ago
It prints a notice when you run it: https://docs.brew.sh/Analytics https://docs.brew.sh/Analytics
yrro 4y ago
Homebrew should support the DO_NOT_TRACK environment variable. https://consoledonottrack.com/ https://consoledonottrack.com/ It doesn't look likely though. I don't think it looks good that comments pointing out that Homebrew's existing behaviour (collecting analytics without obtaining informed consent from users) violates the law have been classified as abuse and hidden! https://github.com/Homebrew/brew/pull/6745 https://github.com/Homebrew/brew/pull/6745
- steve1977 4y ago
  Or, just not track.
- voytec 4y ago
  > Homebrew should support the DO_NOT_TRACK environment variable. No, rather something like TRACK_ME opt-in variable.
- sneak 4y ago
  In retrospect (consoledonottrack operator here) I never should have pushed an opt out standard; it legitimizes opt-out which is indefensible and unethical. Opt-in by advance consent is the only way. Homebrew devs are unethical jerks. Use nixpkgs and don't look back.
  - therealdrag0 4y ago
    What’s unethical about counting errors with no PII?
    - sneak 4y ago
      Errors are the property of the user on the system in which they occurred. Exfiltrating them without consent is unethical and oftentimes illegal, and leaks the user's IP to Google. Homebrew has no claim to them without the consent of the user. It's simple spyware. Unless you report with Tor, it's not without PII. (Homebrew also includes a unique install UUID supercookie which persists, so every analytics data point includes PII in addition to IP address which allows Google to track that user's physical travel history.)
Patrol8394 4y ago
I find this very invasive and I am glad I never used homebrew and always used Macport instead.
- dagmx 4y ago
  Well I have bad news for you there too https://ports.macports.org/statistics/faq/ https://ports.macports.org/statistics/faq/ I really do think that people who are concerned about telemetry should install Little Snitch and also look at each of these programs documentation. Telemetry is called out for most of them, as well as how to disable it. It’s also not inherently bad as it can be a valuable tool to improve their systems, though obviously could be abused too.
  - cgeier 4y ago
    You need to actively install software to report statistics on macports. See further down the linked FAQ.
    - Patrol8394 4y ago
      Exactly! ``` To start submitting statistics, install the mpstats port in your MacPorts installation. sudo port install mpstats ```
sneak 4y ago
Time to write a client to spam both of these unauthenticated data collection endpoints with random noise data to render them useless.
woodruffw 4y ago
Homebrew doesn't "report" anything to Google, much less anything of yours (implying unique identification). This is an unnecessary editorialization. You can see exactly how Homebrew does analytics here[1], and you can see the sum total of the information collected here[2]. No identifiable information is collected or retained. [1]: https://github.com/Homebrew/brew/blob/master/Library/Homebrew/utils/analytics.rb https://github.com/Homebrew/brew/blob/master/Library/Homebre... [2]: https://formulae.brew.sh/analytics/ https://formulae.brew.sh/analytics/
- microtonal 4y ago
  From the Homebrew documentation: A Homebrew analytics user ID, e.g. 1BAB65CC-FE7F-4D8C-AB45-B7DB5A6BA9CB. This is generated by uuidgen and stored in the repository-specific Git configuration variable homebrew.analyticsuuid within $(brew --repository)/.git/config. This does not allow us to track individual users, but does enable us to accurately measure user counts versus event counts. The ID is specific to the Homebrew package manager, and does not permit Homebrew maintainers to e.g. track you across websites you visit. IANAL, but an UUID is definitely PID under the GDPR: ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person; Also see recital 30: Natural persons may be associated with online identifiers provided by their devices, applications, tools and protocols, such as internet protocol addresses, cookie identifiers or other identifiers such as radio frequency identification tags. This may leave traces which, in particular when combined with unique identifiers and other information received by the servers, may be used to create profiles of the natural persons and identify them. The GDPR doesn't only take into account whether an identifier can currently be used to identify a person, but also whether the data can be correlated in the future to do so (e.g. by correlating package installs with visiting project websites, thus deanonymizing the UUID). The only safe way to abide by the GDPR is to avoid storing any non-essential data without consent. I am pretty sure that Homebrew have been violating the GDPR for years by making analytics opt-out. Sadly, anyone who tries to warn them gets banned from their issue tracker.
sigzero 4y ago
> My package manager was reporting my actions to Google and I didn’t even know about that. Great… This has been a known things for a long long time. That is on you for not knowing about it. And it isn't doing anything that you are trying to infer in your statement anyway.
deleted 4y ago
[deleted]

tambourine_man 4y ago

I use homebrew like a black box. I’m glad it exists, but I have no idea how it works and why it’s so complicated. When something breaks and Google is no help I just nuke it and start from scratch. It’s only happened twice in more than a decade, but I still have the feeling that I was better off compiling stuff manually and cultivating a tidy /usr/local/bin like I did in early 2000s. But it’s probably rose-colored glasses and I’d definitively never take the time these days.

acdha 4y ago
I think you’re right about the rose-colored nostalgia: it’s easy to forget how far behind people got on updates. I remember so many support emails where someone had hit a bug which had been patched a year earlier but never thought to install it. A couple of times where people reinvented something which had been added to PHP in the meantime because they didn’t know it was there.
- tambourine_man 4y ago
  But do I need the latest openSSL for local development? Seems more trouble than it should.
  - acdha 4y ago
    That’s why they keep it private by default, but the answer is often yes. There have been multiple times where a package like Python 3.10 required a newer version (1.1.1) than the OS release included (I suspect that’s also why the AWS Lambda runtime is stuck on 3.9 since it’s based on Amazon Linux 2 and that uses 1 .0). This has settled down a bit but the big HTTPS-everywhere push last decade flushed out a ton of things which had been quietly aging in place, unnoticed until someone started depending on SNI, newer crypto suites, actually disabling deprecated versions of SSL/TLS, etc.
    - tambourine_man 4y ago
      Maybe it’s quieted down recently after the HTTPS effort, but I feel like I need to download a whole Unix environment, down to the readline, every now and then when I just wanted to install a trivial thing.

aa-jv 4y ago

I wish we could get the industry to understand that when you build-in analytics and make it hard for people to opt out, you're using their resources. Sure, people don't pay for things like Homebrew (can they even?) - but this is no reason to extract resources from end users without their consent or agency. I have to work very hard to get something like Homebrew installed and in-use in my organization - the IT guys detest it, since they don't have the wherewithal to understand it (or else they'd be higher-paid developers) so when I finally do get it installed and in use (because it is a very productive tool), having it phone home just makes the situation worse. IT guys have asked for my blood on more than one occasion, just because they see something 'uncontrollable' phoning home .. this does a lot more harm than good. That said, homebrew has been absolutely responsible for making MacOS usable for development purposes in this ol' hackers lab, so I'll keep using it - but I sure do wish they'd care a little more about the position they put us in, having to justify the use of it to IT guys .. EDIT: Thinking about it, I'm actually not averse to phoning-home, just the automatic/hidden nature of it. If brew asked me, every 5 or so times that I ran it, if I would like to participate in sending anonymized analytics to the brew devs, and showed me what was being sent (instead of obfuscating it), I'd be a lot more inclined to click "[Yes] - this one time" almost every single time ..

modernerd 4y ago
> people don't pay for things like Homebrew (can they even?) They can and should! https://github.com/homebrew/brew#donations https://github.com/homebrew/brew#donations
- aa-jv 4y ago
  Thanks for the link, I've now donated. :)
Mystery-Machine 4y ago
Isn't it illegal, under GDPR, to track users without their consent?
- Gigachad 4y ago

modernerd 4y ago

> brew update will now be run automatically less often (every 24 hours rather than every 5 minutes) and these auto-updates will be much faster as they no longer need to perform the slow git fetch of the huge homebrew/core and homebrew/cask taps’ Git repositories. Excellent! Thanks to the brew team for this — it was always frustrating to install something and have to wait for a full, slow update first.

febstar 4y ago
> no longer need to perform the slow git fetch Nice. Rust Cargo is also trialling out something similar.
atonse 4y ago
I was just wondering, have they considered storing all that in an SQLite file? And then you could refresh the file every 6 hours, say, and post it on a CDN?
- modernerd 4y ago
  Using SQLite instead of JSON could have worked too and would likely make the manifests smaller: > curl -sI https://formulae.brew.sh/api/formula.json https://formulae.brew.sh/api/formula.json | grep content-length => 19898457 (~19.9MB) > curl -sI https://formulae.brew.sh/api/cask.json https://formulae.brew.sh/api/cask.json | grep content-length => 4023930 (~4MB) But the JSON API has been around for a while so brew 4.0 just makes use of it by default. Brew 3.3 added an off-by-default HOMEBREW_INSTALL_FROM_API bool to let you install from brew's JSON-based API instead of checking out the large (and slow) homebrew/core and homebrew/taps repos: https://formulae.brew.sh/docs/api/ https://formulae.brew.sh/docs/api/ Brew 4 just makes that the default and deprecates the env var (you can use HOMEBREW_NO_INSTALL_FROM_API=1 if you still want to check out the git repos for some reason).
  - mikemcquaid 4y ago
    Homebrew actually passes `--compressed` here so it's smaller: > curl -sI --compressed https://formulae.brew.sh/api/formula.json https://formulae.brew.sh/api/formula.json | grep content-length => 3482583 (~3.3MB) > curl -sI --compressed https://formulae.brew.sh/api/cask.json https://formulae.brew.sh/api/cask.json | grep content-length => 722915 (~0.6MB)

throw0101c 4y ago

On macOS, has anyone moved from/to MacPorts to/from Homebrew? Why did you move? What are the pros and cons of each system?

dchest 4y ago
Moved a long time ago, mostly because MacPorts installed their whole own world of dependencies, while Homebrew used system libraries where possible.
- pseudalopex 4y ago
  Homebrew gave up using OS libraries a long time ago.
dopidopHN 4y ago
Yah like a decade ago. I started to find what I was looking for under home brew, and not with port or fink
lrvick 4y ago
Both are a security shit show, but at least macports bothers to sign their packages.
- acdha 4y ago
  What security benefit do you think that provides?
acdha 4y ago
I switched from MacPorts to Homebrew very early on because it was better contained. I had to support developers who would build with MacPorts and end up with something which would crash with a linker error when they shared it with someone off the team because it was using a MacPorts binary in a non-standard location, or whose shell scripts broke expecting a GNU CLI utility version which was in their path but not their users. MacPorts also took forever to build since it dragged in so many replacements for system libraries. Homebrew has done a much better job of staying out of the way.

st3fan 4y ago

Before this whole threads turns into a misinformed rant fest about opt out telemetry: “Homebrew gathers anonymous aggregate user behaviour analytics using Google Analytics (until our in-progress migration to our own InfluxDB). You will be notified the first time you run brew update or install Homebrew. Analytics are not enabled until after this notice is shown, to ensure that you can opt out without ever sending analytics data.”

jeroenhd 4y ago
That's opt-out, though? It's nice that they tell you, but they don't give you a choice. They're just warning you that you need to opt out. That's not the same as opting in. They're also claiming to log anonymous data while the data they collect is actually pseudonymous as its tied to your specific machine/user, which means it has a whole different status in different privacy jurisdictions. It seems like they could make the data collection anonymous relativelt easily if they just stop tracking individual user installs, though.
- acdha 4y ago
  They don’t collect data until after you’ve been given the chance to opt out. > It seems like they could make the data collection anonymous relatively easily if they just stop tracking individual user installs, though. Doing that would skew the reports to more active users & automated scripts. If you’re asking questions like “how many people will notice if we deprecate this?” you don’t want to count the guy who hammers “brew update” every other command many times more than someone who updates weekly.
  - jeroenhd 4y ago
    > They don’t collect data until after you’ve been given the chance to opt out. That does still make it opt-out, though, even if it's a friendly opt-out. Microsoft's dotnet tools do the same thing. > Doing that would skew the reports to more active users & automated scripts. If you’re asking questions like “how many people will notice if we deprecate this?” you don’t want to count the guy who hammers “brew update” every other command many times more than someone who updates weekly. I know why they're collecting personal identifiers and I completely understand their reasoning behind it. Every website and service does this in some fashion because most requests are automated. You should still ask before you submit any telemetry, though.

Mystery-Machine 4y ago

I despise, despise, Homebrew's "we know better than you" approach to always installing the latest versions of every dependency. How tf is this fine? They don't even offer alternative. They just say "we can't test all of the packages installed and all version combinations, so this is the best we can do". Well, no one asked you to test my exact setup. All I'm asking for is: if I have perfectly working Node 18 and I need to install fcking Shopify CLI, don't fcking install Node 19 and break my whole setup! Tf?!

deleted 4y ago
[deleted]
BillinghamJ 4y ago
You could always manage your packages and their dependencies yourself. Or you could release a new package manager which does provide support for that functionality, build out a team of maintainers, and stay on top of all the releases
- gizmo 4y ago
  That's like saying "if you don't like your country, start your own". The goal isn't to abandon homebrew, but to have it not break things all the time.
  - notpushkin 4y ago
    It's really not. It's borderline impossible (pun intended) to start your own country, mainly because you need to find a piece of land first. Starting a package manager is, like, a few months of work?
- tacker2000 4y ago
  Thats such a cop out answer! So according to you nobody is allowed to criticise anything because “shut up and build it yourself if you dont like it”?
hnlmorg 4y ago

unconed 4y ago

I wonder how many more major versions until "brew update" and "brew upgrade" finally just do the same thing. "But they're not the same!" I don't care.

thiht 4y ago
That makes no sense. They're NOT the same. > I don't care. It doesn't change facts.
- unconed 4y ago
  This is a lesson about mental models. From the brew devs' point of view it doesn't make sense because they are different commands. From the end user's point of view it makes perfect sense because brew is just a tool to install shit with and they do not wish to expend any brain cycles on it. That includes remembering whether this particular tool calls it update or upgrade. You know the second point of view is right because if you type one without arguments, it asks you whether you meant to type the other one. But they're too autistic to realize what that means and actually fix the interface. brew update - update brew brew update thing - update thing Done. Similarly, as someone who only rarely uses it, a huge frustration is that when I do, it invariably wants to update 100+ packages. I never asked for it to do that and I was happy with whatever was installed right before it decided to do that and block my system for 20 minutes. Again, brew devs do not understand their audience.
  - yamtaddle 4y ago
    Disagree. I've been a user for a lot of years and prefer the apt-like distinction between the commands. They do different things. > Similarly, as someone who only rarely uses it, a huge frustration is that when I do, it invariably wants to update 100+ packages. I never asked for it to do that and I was happy with whatever was installed right before it decided to do that and block my system for 20 minutes. There's a setting for that, no need for it to keep being a huge frustration.
    - 4y ago

lrvick 4y ago

Reminder that nothing in Homebrew has any signing or attempt at supply chain integrity. Now that they are moving away from clients using git, so even git commit signing is off the table now. When you install brew you are giving hundreds of people (or anyone who has access to their Github accounts) full remote code execution on your machine. Never ever use brew on a machine you use to access production.

acdha 4y ago
If they were using signed binaries wouldn’t the same people who have permission to merge code have permission to sign compiled binaries (or, realistically, start a CI process which does)?
tasuki 4y ago
I've been using Linux for the past 18 years or so, but damn do the M1 macs look interesting. How does one manage packages on a mac?
- Squarex 4y ago
  you could use nix
  - nishanths 4y ago
    some more choices: MacPorts, pkgsrc
- Chiron1991 4y ago
  Excluding 3rd party tools like Homebrew, one dosn't. The native 'package manager' is the Apple App Store. You can also manually download and install .dmg files of applications (much like .deb or .rpm).
  - lockhouse 4y ago
    macOS also has .pkg installer packages that are native. The only issue is that there is no uninstall functionality built in to them unless the package provides their own. https://en.wikipedia.org/wiki/Installer_(macOS) https://en.wikipedia.org/wiki/Installer_(macOS)

anshargal 4y ago

While I use Homebrew on my Mac — it is a major risk. I am afraid that the project is not following strict security policies and will be compromised at some point. Evil package or evil version of brew can steal or modify my data. I think this will also hurt the Mac platform. I wish Apple would invest some effort into building an App Store for cli programs. While it may be complicated for the community(require signing, sandboxing, developer effort), it is likely to have better security guarantees than Homebrew.

rswail 4y ago
They have, it's called Macports. It started as a port to Darwin of the existing *BSD ports and (I believe) is subsidized by Apple. It installs itself in /opt/local, it respects the Apple SIP. Homebrew basically sucks, because it doesn't follow Unix conventions and it doesn't follow MacOS conventions. Macports has both pre-compiled and build-from-source, supports current and past MacOS releases, uses xcode/clang for compilation, supports port variants and multiple versions installed in parallel (with "port select" to choose a default) etc etc. Not sure why people use anything else.
nrvn 4y ago
This, absolutely! Apple should close this gap and I am puzzled why they have not done that yet. Because even for iOS development people need things beyond the xcode toolcahin and they resort to either of the available options. Homebrew is just one of them. Not only cli app store but the mac app store also badly needs some love.
- SllX 4y ago
  In 2010 I wanted Apple to do this. In 2023 I want Apple to stay as far the hell away as possible from App and package management as possible on my Macintosh. I don’t have the same hang ups on my iPhone, but I don’t want a merger of policies and incentives between the two platforms either.
ianai 4y ago
Or just hire a few FTEs to properly support and maintain the CLI. Pull in new FreeBSD base at releases if they really want to axe their overhead. It's always just read as absolutely lazy how slowly the CLI progresses. Hire a few more and they could absolutely offer a package repo. This company dwarfs Red Hat prior acquisition. A company like Apple could kick whatever money to an OSS project and write it off as charity for taxes, I think for that matter.

Lio 4y ago

Thanks for the hard work everyone. I've used brew and brew installed software almost everyday since it was first launched way back when. Mike, Max and the gang have materially improved my life at least, cheers! :D

latexr 4y ago
Despite mentioning he started Homebrew every chance he gets, Max hasn’t been part of Homebrew for longer than he was a part of it.

Upvoter33 4y ago

Man there are a lot of complaints about this free software no one is forcing you to use. I would start with a thanks to the people who spend a lot of time on this, and probably not for much wealth. I know I greatly appreciate the existence of homebrew.

wg0 4y ago
Entitlement syndrome. Nothing is perfect, not even paid software is perfect. At least open source gives a chance for someone to look into how it's done, suggest/discuss something different and submit a modification if affordable. EDIT: Typo
elteto 4y ago
[flagged]
- dang 4y ago
  Please don't take HN threads further into flamewar. We're trying for something different here. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
dagmx 4y ago
Not even just entitlement, but a lot of people thrown off by the existence of telemetry. Telemetry that it tells you about when you install it, and is mentioned on their site. So not only are people complaining about free software, they’re complaining because they don’t pay attention. It’s the “Everything someone else does is not as good as what I do” mentality
wayne-li2 4y ago
This is the ugly side of HN in my opinion. Discussions here are usually very reasonable, except for a few subjects such as telemetry. I guess to the hacker heads of HN, telemetry is as political as religion for regular people.
deleted 4y ago
[deleted]

t8sr 4y ago

As an old hand who was around when homebrew started, I feel obliged to let people know there are alternatives. If you find brew's take-over-your-system-and-youll-thank-me approach off putting, and/or you value stability over the coolness factor, MacPorts is still alive and well (https://www.macports.org https://www.macports.org), and in-fact has basically all the same packages brew does. In 18 years of using MacPorts, it's never messed up my system, broken something that used to work or decided that I don't get to run commands right now, because it wants to run an upgrade. (It's also never spied on me.) The price you pay for that is that more things are compiled from scratch, but hey - you only have to do that once, and it only takes like 20 minutes on a modern Mac. Upgrades are generally pretty fast.

baliex 4y ago
I used to be a staunch macports evangelist but ended up switching to homebrew. I've found it to be much simpler. And, as a counter to your experience of not having it mess up a machine, every time you upgrade macOS to the next major version you have to jump through some hoops to get it to play ball again. Painful. At some point I gave up on the hoops and installed homebrew instead and haven't looked back.
- drcongo 4y ago
  This exactly mirrors my experience with the two systems.
- t8sr 4y ago
  Well, you can nuke macports just by deleting /opt/local. It's annoying to have to recompile for sure, but at least it's a simple solution.
  - baliex 4y ago
    That does sound simple, but is not the process the macports docs suggest.
  - ezfe 4y ago
    You can do the same thing with brew, `/opt/local/brew`

toastercat 4y ago

I used Linuxbrew for a while before switching completely to nix-pkg due to some recurring issues I had downloading some packages. nix-pkg is quite nice and noticeably faster, although rough around the edges, and the commands are hard to remember (so I just set some aliases), but overall I am happy.

mekster 4y ago
For Linuxbrew, having packages installed under, /home/linuxbrew/.linuxbrew makes you wonder how much of the developer's mind is "works for me" instead of following more common sense conventions like at least put them under /usr/local or /opt instead of some special user folder in /home.

anacrolix 4y ago

Rewrite it in something compiled already, it's insanely slow

jray 4y ago
Crystal is good option. https://crystal-lang.org/ https://crystal-lang.org/
wg0 4y ago
<insert rust is the cure for life, death and beyond, compiles safely to 42>
darthrupert 4y ago
One would think that most of what it does is IO. Perhaps the resolver could be written in Rust for maximum effect?
woodruffw 4y ago
Ruby is slow, but Ruby is not the main reason Homebrew can be slow: Homebrew's execution time is mostly bound by network round-trips and I/O.

wg0 4y ago

Thank you. I tend to rely for even open source GUI apps because the experience of installing/removing packages have been smooth (at least for me) so even on Ubuntu, I find myself using brew instead of apt/snap for personal use. Side question - what can we do about improving security? Of the possibility that packages are not poisoned? Some sort of central CA/GPG or similar requiring to sign the packages or there would always be some holes and it is a hard problem to solve?

Hackbraten 4y ago
Prior discussions on package signing: - https://github.com/Homebrew/brew/issues/5852 https://github.com/Homebrew/brew/issues/5852 - https://github.com/Homebrew/brew/pull/4120 https://github.com/Homebrew/brew/pull/4120

ramesh31 4y ago

Is it still slow?

CharlesW 4y ago
`brew` has never been slow for me. (Subjective, obv.)
- yamtaddle 4y ago
  I've heavily used probably four Linux package managers, plus both major ones on Mac, and have used two or three less-common Linux package managers at least a little bit, plus a couple of the BSDs. Oh, and Chocolatey on Windows. I've never gotten this complaint about Brew at all. It has never seemed notably slow to me.
  - fliife 4y ago
    Nothing can feel slow to me anymore after dealing with emerge on gentoo, spending close to 20min solving dependency requirements. Surprisingly, compiling everything was the quick part, the frustration came from dependency resolution
  - silverwind 4y ago
    Try Arch's pacman which installs hundrets of packages in a few seconds. brew is like factor 50 slower than pacman.
  - deleted 4y ago
    [deleted]
silverwind 4y ago
It's still ruby so it's still slow.

tacker2000 4y ago

[flagged]

antihero 4y ago
You shouldn’t use brew for development tools and runtimes really, you should should use a language specific version manager or asdf. Brew for system stuff.
- tacker2000 4y ago
  I agree! The problem is, in the PHP world i rely heavily upon Laravel Valet, and it supports only brew…
- jillesvangurp 4y ago
  Agreed, sdkman and mini conda are two nice options for this. In general, anything Java, python, node.js, etc. related you don't want to have installed globally if you can avoid it.
nonninz 4y ago
Agreed. For these kinds of versioned tools (mostly language compilers/interpreters) I've switched to asdf[1][2] and never looked back. $brew install asdf [1] https://asdf-vm.com/ https://asdf-vm.com/ [2] https://news.ycombinator.com/item?id=33323261 https://news.ycombinator.com/item?id=33323261
DanHulton 4y ago
Does "nazi" even mean anything anymore, or do we just use it to describe things we don't like? Does nobody care about Godwin's law?
- rvz 4y ago
  It is so overused that it has lost almost all its meaning. It's getting very boring to see it being used around loosely and carelessly, especially when the word is used to describe things that people don't like. Godwin's Law certainly applies in this case.

mkrishnan 4y ago

well, still needs `sudo` :( :(

thiht 4y ago
You can install brew locally: https://stackoverflow.com/a/35867178 https://stackoverflow.com/a/35867178 It's not supported officially (ie. if you have issues with a package you're on your own), but it works great. I've used Homebrew like this for a few years.
mdaniel 4y ago
Aside from what the sibling comment said about the "local" install, if you don't want them to run sudo for you, I'd bet $5 that so long as the directories end up with the permissions necessary, you could (effectively) `alias sudo='env'; brew install` and it'd be fine. I do not have `NOPASSWD` on sudo and I can attest that with all my years of Homebrew and Linuxbrew, it has never once tried to run sudo "under the covers"
n8henrie 4y ago
As do apt, pacman, a multi-user nix install... isn't that pretty standard for a system-wide package manager?

bsnnkv 4y ago

I have a lot of love for Homebrew from many years of using it, but I don't think you'll ever find me using it in macOS or Linux again. I use Nix on both now and I'm convinced that it is the saner way of doing things.

dividedbyzero 4y ago
Does Nix still have that extremely steep and high learning curve and huge time invest before you actually grok it? I'd love a Nix that is about as hard to use as homebrew, but no luck so far.
- rch 4y ago
  This might be helpful: -- https://zero-to-nix.com/ https://zero-to-nix.com/ Someone also did a video walkthrough of this material recently. I don't have the link, but it might be worth searching for.
- bojo 4y ago
  To be fair you only really need to know the commands to invoke which are similar to brew as far as what they do, and not the underlying nix expression language which is where things get difficult. Unless you intend to go full power user and add your own overrides, in which case might not be worth it.
- bsnnkv 4y ago
  Imo, no. I think the documentation is very good, unlike what I had heard. The thing that I really had to invest in was my ability to patiently read documentation closely instead of aimlessly trying to find a shortcut by jumping around the doc pages.
  - anthlax 4y ago
    Haha - I really began to learn nix when I started to read the docs before bed like a novel. I’ve started to do this for more libs / frameworks and it’s going quite well - It seems to be the fast track to power user status!

dividedbyzero 4y ago

One thing about Homebrew that's really great and somewhat obscure is that you can use Ruby code inside brewfiles. I use that to have just one brewfile in yadm and make it do slightly different things on work vs personal laptop.

cratermoon 4y ago

All of these Homebrew users complaining about telemetry in brew, but they use Apple macOS? https://news.ycombinator.com/item?id=25204909 https://news.ycombinator.com/item?id=25204909

ossusermivami 4y ago

I am grateful for brew! I have a macbook that I use sometime and it let me install software easily on it...

gandalfgeek 4y ago

Just came here to say big thanks to the Homebrew crew. First thing I install on a new Mac. There's so much thankless toil that goes into maintaining package infrastructure that we all just take for granted. Thank you!

cunningfatalist 4y ago

Working on a Mac wouldn't be the same without Homebrew. Thanks for all the hard work!

ripley12 4y ago
I feel the same way about Linux - big thanks to the Homebrew team.

jiayo 4y ago

Didn't the author sunset this project to become a web3 advocate and pivot to a new project where some dubious NFT would be exchanged for package installations? I guess 2022 came and went since then...

deleted 4y ago
[deleted]
coolspot 4y ago
https://youtu.be/zcL4oOTZv1o?t=115 https://youtu.be/zcL4oOTZv1o?t=115
latexr 4y ago
You’re thinking of Max Howell, the original creator of Homebrew. Rest assured, Max hasn’t been part of Homebrew for years—for longer than he was ever a part of it—so he has no hand in sunsetting or making other decisions on Homebrew’s behalf. Regarding his web3 stuff, the Homebrew developers learned about them at the same time as everyone else (there was a tweet from the official account at the time). There is no relation between both projects. Max takes every chance he gets to mention Homebrew, so the confusion is understandable but unfortunate. Even in his web3 package manager he mentions Homebrew as if it’s the old stuff.

dmillar 4y ago

TIL homebrew updated(s) itself automatically

WirelessGigabit 4y ago

Time to set HOMEBREW_NO_GOOGLE_ANALYTICS HOMEBREW_NO_ANALYTICS I hate opt-outs.

deleted 4y ago
[deleted]

nikolay 4y ago

Yikes! This no longer shows the new formulae and casks - I've used Homebrew as a discovery tool, now I need to watch the git commits [0]! [0]: https://github.com/search?q=repo%3AHomebrew%2Fhomebrew-core+%22%28new+formula%29%22&type=commits&s=committer-date&o=desc https://github.com/search?q=repo%3AHomebrew%2Fhomebrew-core+...

latexr 4y ago
Subscribe to the commits with an RSS reader: https://github.com/Homebrew/homebrew-core/commits/master.atom https://github.com/Homebrew/homebrew-core/commits/master.ato...
- nikolay 4y ago
  Both approaches only show the new formulae in the main tap - the old behavior showed across all taps you're subscribed to.
  - latexr 4y ago
    If you really want to keep the old behaviour add `export HOMEBREW_NO_INSTALL_FROM_API=1` to your shell’s startup files. You won’t get the speed boost from the new behaviour but it seems like a tradeoff you’d be willing to make.
    - nikolay 4y ago
      Unlike the old `export HOMEBREW_UPDATE_REPORT_ALL_FORMULAE=1`, which I've had already, your suggestion actually works! Thank you!
mdaniel 4y ago
I can't swear to it, because I have a locally patched copy that reports the way I want, but I believe `export HOMEBREW_UPDATE_REPORT_ALL_FORMULAE=1` may put that behavior back: https://docs.brew.sh/Manpage#environment https://docs.brew.sh/Manpage#environment

rainboiboi 4y ago

Thank you for the hard work in maintaining Brew!